Overview

overview

10

Static

static

3

BrowserTool.exe

windows7-x64

6

BrowserTool.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BrowserTool.exe

  • Size

    99.6MB

  • Sample

    240903-z3sd1aybqe

  • MD5

    f489556fdde15b99e202a06f0cf513aa

  • SHA1

    dc7991c837e336484d9bcd56fbe42129cc5a62d0

  • SHA256

    0b5fe211d558daa7d54207d2869f53d0a91ae16397343fd2605fd3a0f292dd21

  • SHA512

    dd87414e68ba61a6821d27853c45399193520d090fc9f69f7c4bd5ba1cc591e0384d680c454525d99d95f0b880cc50dffcca201d838d3c8f2d595ba27eda0cdd

  • SSDEEP

    786432:d0urM/MqRmUT0kBKpM6i8nOhxYjjCmrkIvchTJCILjXvxscyQZfbyrBovl+4BPbG:d0XvQAsKlJGkzR21vYdsj

Score
10/10
credential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      BrowserTool.exe

    • Size

      99.6MB

    • MD5

      f489556fdde15b99e202a06f0cf513aa

    • SHA1

      dc7991c837e336484d9bcd56fbe42129cc5a62d0

    • SHA256

      0b5fe211d558daa7d54207d2869f53d0a91ae16397343fd2605fd3a0f292dd21

    • SHA512

      dd87414e68ba61a6821d27853c45399193520d090fc9f69f7c4bd5ba1cc591e0384d680c454525d99d95f0b880cc50dffcca201d838d3c8f2d595ba27eda0cdd

    • SSDEEP

      786432:d0urM/MqRmUT0kBKpM6i8nOhxYjjCmrkIvchTJCILjXvxscyQZfbyrBovl+4BPbG:d0XvQAsKlJGkzR21vYdsj

    Score
    10/10
    credential_accessdiscoveryspywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks